A law firm data breach can expose hospital patients who never knew their records left the hospital, and that is exactly what happened this fall. Buchalter, a California law firm that provides legal services to Arrowhead Regional Medical Center, discovered on August 28, 2026 that an unauthorized party had accessed data on its systems. By September 4 the firm confirmed that certain hospital patients’ information was involved, and notification letters followed once contact details were gathered on September 21. Reports put the number of affected patients at about 13,000. Health data reaches outside counsel through malpractice defense, payer disputes, collections, employment cases and regulatory investigations. Under HIPAA, a firm handling that data for a hospital is usually a business associate, with its own legal duties. For hospitals and the firms that represent them, the practical question is how much patient data actually needs to leave the hospital, and how the firm protects what it receives.
Overview: Five Points for Hospitals and Their Outside Counsel
Our team works with healthcare providers and with professional services firms, and we see both sides of this data handoff.
- Most PHI sent to counsel is more than the matter needs. Bulk exports and full charts travel when a few records or a summary would do.
- Outside counsel is usually a business associate. That brings HIPAA Security Rule obligations to the firm, not only contract terms.
- Matter files outlive the matter. Closed cases sit in document systems and backups for years, often with patient data no one needs anymore.
- E-discovery adds more copies. Review platforms, vendors and expert witnesses each receive their own set.
- Notification is slow when data is scattered. It took weeks in this case to match affected records to people, which is common when data has no inventory.
Why a Law Firm Data Breach Puts Patients at Risk
A law firm data breach puts patients at risk because firms collect concentrated, sensitive records for disputes and keep them in systems built for collaboration rather than clinical privacy. Attackers know that firms hold high-value data for many clients at once.
How Patient Data Reaches Outside Counsel
Hospitals send patient information to counsel for medical malpractice defense, billing and payer litigation, debt collection, employment disputes involving clinical staff, and government investigations. Each matter tends to start with a document request, and the fastest response is often a large export.
One view inside hospitals is that counsel should get everything so nothing is missed in litigation. The other view, often held by privacy officers, is that only the records tied to the claim should go. Both have weight: missing evidence carries legal risk, and excess data carries breach risk.
We recommend a defined handoff process in which legal and privacy review the request together, with a default toward the minimum necessary standard HIPAA already requires.
Business Associate Status in Practice
When a firm creates, receives or maintains PHI on a hospital’s behalf, it is generally a business associate and must meet the HIPAA Security Rule. Many firms sign the agreement without changing how they store matter files.
Some partners argue that attorney-client privilege and existing confidentiality duties already cover them. Privilege protects against disclosure in litigation; it does not protect against ransomware. The security obligations are separate and technical, as our guide to cybersecurity gaps law firms need to close explains.
Why Detection-to-Notice Takes So Long
In this incident the firm detected the intrusion in late August and had notification addresses by late September. That gap usually reflects a data problem: the firm must work out which files were touched, which belong to which client, and which contain patient identifiers.
Hospitals sometimes see that delay as the firm’s failure. Often it reflects the absence of a data inventory at both organizations. Faster notice starts with knowing where patient data sits before anything goes wrong.
How Hospitals Limit What They Send
Hospitals reduce exposure from a law firm data breach most effectively by sending less, because data that never leaves the hospital cannot be stolen from the firm. This step costs little and pays off on every matter.
Minimum Necessary at Handoff
Create a short intake form for legal requests that records the matter, the records requested and the justification. Have a privacy analyst confirm scope before release.
Litigation teams may push back that this slows discovery deadlines. A same-day review standard usually resolves that concern, and it still catches the requests that would have sent an entire patient population when ten charts were needed.
Redaction and De-identification
For many matters, de-identified or partially redacted data serves the legal purpose. Statistical analyses in payer disputes, for example, can often run on records stripped of names and Social Security numbers, with a re-identification key kept at the hospital.
Secure Transfer Channels
Use an encrypted file-sharing platform with expiring links and download logs rather than email attachments or portable drives. Our third-party risk reduction guide for healthcare networks covers how to set these up across vendors.
How Law Firms Protect PHI They Hold
Law firms protect hospital PHI best by organizing it by matter, restricting who can open it, and destroying it when the matter closes. These controls also protect every other client’s sensitive files.
Matter-Level Access in the Document System
Most firms use a matter-centric document management system. Configure healthcare matters with restricted access so only the assigned team can open them, and apply ethical-wall style controls automatically when a matter is tagged as containing PHI.
Firms worry that restrictions slow staffing changes. Group-based permissions tied to the matter team usually make changes faster, not slower, once set up. A cyber security audit can show which matters are currently open to the whole firm.
Closed-Matter Retention and Destruction
Define how long healthcare matter files are kept after a case closes and what happens to backups and archived copies. Then actually run the destruction, with a certificate the hospital can keep.
Records managers sometimes prefer keeping everything in case of appeals or malpractice claims against the firm. A tiered approach works: retain pleadings and work product, but return or destroy raw patient data once the purpose ends, as most business associate agreements already require.
E-Discovery Platforms and Experts
Review platforms, litigation support vendors and expert witnesses each hold copies. Track them in a matter data map, require the same safeguards by contract, and collect confirmation of deletion at matter close.
What to Check After a Law Firm Data Breach
After a breach at outside counsel, both the hospital and the firm need fast answers about which patients were affected and what each organization must report. Preparation decides how quickly those answers come.
Responsibilities Under the Agreement
The business associate must report the breach to the hospital, and the hospital generally carries the duty to notify patients unless the agreement assigns it to the firm. Settle who sends letters, who pays for credit monitoring and who staffs the call center before an incident, not during one.
Incident Response Support
Make sure your data breach incident response plan names outside counsel as a possible breach source and includes their contacts. Firms should do the same for their healthcare clients.
Annual Assurance
Ask outside counsel each year for evidence of security controls: multifactor authentication, endpoint protection, backup testing and access reviews for healthcare matters. Our HIPAA compliance audit checklist for healthcare includes vendor assurance items you can adapt.
Frequently Asked Questions
Is a law firm a business associate under HIPAA?
Usually, yes, when it creates, receives, maintains or transmits PHI to provide legal services to a covered entity such as a hospital. That status brings HIPAA Security Rule duties in addition to contract terms.
Who notifies patients after a law firm data breach?
The firm must notify the hospital, and the hospital typically notifies patients unless the business associate agreement assigns that task to the firm. Agree on this in advance.
How much patient data should a hospital send to counsel?
Only what the matter reasonably needs under the minimum necessary standard. Many matters can use redacted or de-identified records with a re-identification key kept at the hospital.
What should firms do with patient data after a case closes?
Return or destroy it as the business associate agreement requires, including copies on review platforms, backups and with experts, and give the hospital written confirmation.
Can small firms meet these requirements?
Yes. Restricted matter access, multifactor authentication, encrypted transfer and a disciplined closing process are achievable without a large security staff, especially with a managed IT partner for law firms.
Who Is Behind This Guidance
Mindcore Technologies supports healthcare organizations and professional services firms, including law firms, with security assessments, compliance programs and managed security. This article draws on our work helping hospitals tighten vendor data handoffs and helping firms secure the matter systems where client data lives. You and your counsel decide how each matter is handled; our role is to make sure the systems behind those decisions protect the people in the files. Mindcore is led by CEO Matt Rosenthal, who focuses on giving regulated organizations practical, audit-ready security that fits how they really work.
Reduce Litigation Data Risk With a Free Strategy Call
A breach at outside counsel exposes patients whose records traveled further than they needed to, and the fix is shared between the hospital and the firm. Hospitals should send the minimum, redact where they can and use secure transfer. Firms should restrict healthcare matters to the assigned team, track every copy on review platforms and with experts, and destroy patient data when the matter closes. Both should agree in advance on notification duties and check controls every year. If you want help mapping where patient data goes once it leaves your organization, or securing the matter systems that receive it, book a free strategy call with our cybersecurity compliance team. We will review your data handoffs and give you a clear plan to reduce the exposure.
